Privacy

What WillowMap stores

You can use WillowMap without an account — your maps and pins are stored in our database and identified by a server-issued cookie, and we do not ask for an email, name, or password.

Signing in is optional and only needed to save/remix a map someone else shared with you. We offer Google sign-in and email (magic-link) sign-in — either way, we store your email address and, for Google, the name and profile photo Google shares with us. We do not require this to use WillowMap for your own maps.

Your browser also keeps a local list of recent search and AI queries (under willowmap:history:v1 in localStorage) so you can re-run them quickly. Entries older than 90 days are pruned automatically the next time the app loads, and you can clear the list at any time from the recent-queries panel.

If you accept the analytics banner, WillowMap records a small set of first-party usage events: places displayed in Explore results (their rank and truthful photo-fallback presentation tier), whether an available video qualified for hero or secondary placement, successful place saves, and opens of directions. We do not include search text, place names, map IDs, precise coordinates, or user-authored content in analytics events.

Analytics uses a random session ID stored in your browser. It is pseudonymous and is not your account ID; WillowMap does not attach an account ID even when you are signed in. When an event needs location context, latitude and longitude are rounded to 0.1° on the device and checked and rounded again by the server. We target a 90-day analytics retention period. In this initial release an owner enforces retention with a manual database cleanup, rather than an automatic expiry job.

Third parties contacted on page load

• Vercel hosts the app. Standard request logs (IP, user agent, path) are kept for operational purposes.
• OpenFreeMap serves the base map tiles. Tile requests are made directly from your browser; no API key is required.
• Google Maps Platform (Places)powers search, autocomplete, and place details. All Places traffic is proxied through WillowMap's own server (/api/places/*) — your browser does not contact googleapis.com directly, and no Google API key is exposed to the client. Reverse-geocode calls round the viewport center to ~110 m before they leave your device.
• Anthropic handles AI search. Your prompt is sent server-side from WillowMap; we do not pass identifiers.
• Google (Sign-In) and Resend (email delivery) are contacted only if you choose to sign in — Google for Google sign-in, Resend to deliver a magic-link email. Neither is contacted otherwise.

Fonts and icons

Material Symbols (the icon font) and Inter (the UI font) are self-hosted from WillowMap's own origin. Your browser does not contact fonts.googleapis.com or fonts.gstatic.com.

Cookies

WillowMap uses one HTTP-only cookie to keep your maps editable across sessions on the same browser. Analytics uses localStorage rather than an analytics cookie, and WillowMap does not use advertising cookies.

Analytics choice

We show the analytics consent banner to everyone, regardless of region, and send no analytics events until you explicitly accept. Declining sends no analytics events. You can change your choice at any time in Settings.

Operational error reporting is separate, consent-independent, and treated as essential to diagnosing failures and keeping the service reliable. A client error report can contain an allowlisted context, a bounded error message, the current path and query string, a timestamp, limited scalar diagnostic fields, and server-added user agent and referring-page headers. Error messages can sometimes contain unexpected data, so do not deliberately put private text in them. Reports are available to WillowMap owners in Vercel runtime logs and, when configured, Sentry. They are not used for product analytics or advertising.

Contact

Questions or deletion requests: hello@kiruna.ai.

To delete pseudonymous analytics, copy your analytics session ID from Settings and include it in your request. An owner will remove matching analytics rows manually. Account and map deletion requests can use the same address.